CVE-2025-30355highobserved exploitationCWE-20

CVE-2025-30355: high-severity vulnerability in element-hq synapse

Synapse vulnerable to federation denial of service via malformed events

Published

Follow this CVE+ Monitor synapse+ Monitor matrix-synapse

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 7.1epss 1.2%
from disclosure to weapon1 day
Published on NVDMar 27
1st PoC+1d
VulnCheckMar 26
Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Affected products
element-hq · synapse
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — element-hq synapse

In the same product, most dangerous first.

CVE-2024-31208MEDIUMSynapse's V2 state resolution weakness allows DoS from remote room membersEPSS 1.5%CVE-2024-52805HIGHSynapse allows unsupported content types to lead to memory exhaustionEPSS 0.7%CVE-2024-53863HIGHSynapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decodersEPSS 0.6%CVE-2024-37302HIGHSynapse denial of service through media disk space consumptionEPSS 0.6%CVE-2024-52815HIGHSynapse allows a a malformed invite to break the invitee's `/sync`EPSS 0.6%CVE-2025-61672MEDIUMSynapse: Invalid device keys degrade federation functionalityEPSS 0.5%